<!DOCTYPE html>
<html lang="zh-CN">





<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/apple-touch-icon.png">
  <link rel="icon" type="image/png" href="/img/favicon.png">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="description" content="安全行业从业者，主要方向PC逆向附带安卓和Linux逆向，时不时喜欢写点BUG代码">
  <meta name="author" content="Cray">
  <meta name="keywords" content="">
  <title>编写基础调试器：第一部分（基础） ~ 逆向安全博客</title>

  <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/5.12.1/css/all.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/mdbootstrap/4.13.0/css/mdb.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/3.0.1/github-markdown.min.css"  >

<link rel="stylesheet" href="//at.alicdn.com/t/font_1067060_qzomjdt8bmp.css">



  <link rel="stylesheet" href="/lib/prettify/tomorrow.min.css"  >

<link rel="stylesheet" href="/css/main.css"  >


  <link rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css"  >


<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">


    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/">首页</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/archives/">归档</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/tags/">标签</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/links/">友链</a>
          </li>
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="view intro-2" id="background" false
      style="background: url('https://gitee.com/cve/BlogImg/raw/master/VM_tools/image-20201123095837741.png') no-repeat center center;
      background-size: cover;">
    
        <div class="full-bg-img">
        <div class="mask rgba-black-light flex-center">
          <div class="container text-center white-text fadeInUp">
            <span class="h2" id="subtitle">
              
                编写基础调试器：第一部分（基础）
              
            </span>

            
              <br>
              

              <p>
                
                  
                  &nbsp;<i class="far fa-chart-bar"></i>
                  <span class="post-count">
                    2.8k 字
                  </span>&nbsp;
                

                
                  
                  &nbsp;<i class="far fa-clock"></i>
                  <span class="post-count">
                      11 分钟
                  </span>&nbsp;
                

                
                  <!-- 不蒜子统计文章PV -->
                  
                  &nbsp;<i class="far fa-eye" aria-hidden="true"></i>&nbsp;
                  <span id="busuanzi_container_page_pv">
                    <span id="busuanzi_value_page_pv"></span> 次
                  </span>&nbsp;
                
              </p>
            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="py-5 z-depth-3" id="board">
        <div class="post-content mx-auto" id="post">
          <div class="markdown-body">
            <h3 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h3><p>笔者其实准备自己写一份Windows上环三支持32位和64位的调试器，经过阅读XP中的windbg和开源的X64dbg代码，都觉得其实道理都是一样的，基本核心就是循环处理异常，只是写法不同而已，在git上找了很多代码来看，找到了下面这份从0到1的代码，写的通俗易懂，且文档写的极佳，故作翻译，也给自己巩固开发知识。但是笔者非英语专业毕业，本文就根据笔者的理解进行翻译，如有偏差，还请斧正（原文地址放在文末）</p>
<h3 id="编写基础调试器：第一部分（基础）"><a href="#编写基础调试器：第一部分（基础）" class="headerlink" title="编写基础调试器：第一部分（基础）"></a>编写基础调试器：第一部分（基础）</h3><p>作为软件开发人员（或逆向工程师），调试器是一种宝贵的工具。它们允许对程序进行运行时分析和自省/理解，以了解其工作原理，但有时也不行。本系列文章将探讨如何开始在x86或x64体系结构上的Windows基础调试器以及它们的工作方式</p>
<h4 id="附加-分离"><a href="#附加-分离" class="headerlink" title="附加/分离"></a>附加/分离</h4><p>为了调试进程，调试器必须能够附加到该进程。这意味着调试器应该有一种与进程交互的方式，使得调试器将可以访问进程的地址空间，停止和继续执行，修改寄存器的能力，等等。同样，调试器应该能够安全地脱离进程，并在调试会话结束后继续运行。在Windows平台上，这是通过调用<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms679295(v=vs.85).aspx">DebugActiveProcess</a>函数并指定目标的进程标识符来实现的。或者，也可以通过调用<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx">CreateProcess</a>来完成带有<code>DEBUG_PROCESS</code>或<code>DEBUG_ONLY_THIS_PROCESS</code>创建标志。后一种方法将创建一个新进程并附加到该进程，而不是附加到已在系统上运行的进程。附加后，调试器可以使用<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms679307(v=vs.85).aspx">DebugSetProcessKillOnExit</a>设置调试线程在退出时是否终止所有被调试进程的线程。最后，分离过程是对<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms679296(v=vs.85).aspx">DebugActiveProcessStop</a>的直接调用。将所有这些放在一起会产生类似于以下内容的代码：</p>
<pre><code class="C++">const bool Debugger::Start()
&#123;
    m_bIsActive = BOOLIFY(DebugActiveProcess(m_dwProcessId));
    if (m_bIsActive)
    &#123;
        const bool bIsSuccess = BOOLIFY(DebugSetProcessKillOnExit(m_bKillOnExit));
        if (!bIsSuccess)
        &#123;
            fprintf(stderr, &quot;Could not set process kill on exit policy. Error = %X\n&quot;, GetLastError());
        &#125;
        return DebuggerLoop();
    &#125;
    else
    &#123;
        fprintf(stderr, &quot;Could not debug process %X. Error = %X\n&quot;, m_dwProcessId, GetLastError());
    &#125;

    return false;
&#125;

const bool Debugger::Stop()
&#123;
    m_bIsActive = BOOLIFY(DebugActiveProcessStop(m_dwProcessId));
    if (!m_bIsActive)
    &#123;
        fprintf(stderr, &quot;Could not stop debugging process %X. Error = %X\n&quot;, m_dwProcessId, GetLastError());
    &#125;

    return m_bIsActive;
&#125;</code></pre>
<p>其中，<em>m_dwProcessId</em>和<em>m_bKillOnExit</em>是通过调试器构造函数提供的参数（请参见示例代码）。BOOLIFY宏也很简单</p>
<pre><code>#define BOOLIFY(x) !!(x)</code></pre>
<p>这样定义保证返回类型安全。至此，我们有了一个简单的调试器，该调试器可以附加到目标进程或从目标进程分离，但是不能处理任何调试事件。</p>
<p>接下来是这是调试循环进入的地方。</p>
<p><strong>调试循环</strong></p>
<p>任何调试器的核心组件都是调试循环。它负责等待调试事件，处理所述事件，然后等待下一个事件（即循环）。在Windows平台上，这非常简单。Microsoft就此步骤需要完成的工作编写了一个<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms681675(v=vs.85).aspx">调试循环案例</a>。涉及的步骤是（在一个循环中）调试器调用<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms681423(v=vs.85).aspx">WaitForDebugEvent</a>，它等待来自进程的调试事件。这些调试事件在为<a target="_blank" rel="noopener" href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms679308(v=vs.85).aspx">DEBUG_EVENT</a>，里面的枚举值通常是与进程和线程的创建/销毁，DLL的加载或卸载，任何其他异常或调试字符串输出相关的事件。该函数返回后，将使用与特定调试事件相关的信息填充<code>DEBUG_EVENT</code>结构。至此，调试器将处理该事件。处理事件后，处理程序必须向<a target="_blank" rel="noopener" href="https://www.codereversing.com/blog/archives/msdn.microsoft.com/en-us/library/windows/desktop/ms679285(v=vs.85).aspx">ContinueDebugEvent</a>提供一个处理结果，<code>dwContinueStatus</code>是一个DWOR类型变量，用于告诉引发事件的线程在处理事件后如何继续执行。对于大多数事件，即<code>CREATE_PROCESS_DEBUG_EVENT</code>，<code>LOAD_DLL_DEBUG_EVENT</code>等等，您想要继续执行，因为这些事件并未反映出程序行为的任何错误，而是通知调试器更改过程状态的事件。通过选择<code>DBG_CONTINUE</code>作为继续状态来完成此操作。对于异常情况，例如导致未定义程序行为的异常（例如访问冲突，非法指令执行，除零等），这是程序无法自己解决的问题。此时的调试器工作是收集和显示与崩溃有关的信息，并且在大多数情况下，终止进程。对于这些异常，终止可以在处理程序内部进行，或者调试器可以选择继续使用<code>DBG_EXCEPTION_NOT_HANDLED</code>进行调试事件返回。保持原状，表示调试器放弃处理此条异常。几乎所有情况下，程序随后会立即终止。但是，有时会出现一些极端情况，尤其是在恶意软件中，在该过程中，进程将安装其自己的运行时异常处理程序作为一种混淆技术，并生成自己的运行时异常以在该处理程序中进行处理以实现某些功能。在这种情况下继续执行异常不会导致崩溃，因为在调试器将其沿着异常处理程序链转发后，该进程便能够处理其自身的异常。暂时先不说这类情况。典型的调试循环如下所示</p>
<pre><code class="C++">const bool Debugger::DebuggerLoop()
&#123;
    DEBUG_EVENT dbgEvent = &#123; 0 &#125;;
    DWORD dwContinueStatus = 0;
    bool bSuccess = false;

    while (m_bIsActive)
    &#123;
        bSuccess = BOOLIFY(WaitForDebugEvent(&amp;dbgEvent, INFINITE));
        if (!bSuccess)
        &#123;
            fprintf(stderr, &quot;WaitForDebugEvent returned failure. Error = %X\n&quot;, GetLastError());
            return false;
        &#125;

        m_pEventHandler-&gt;Notify((DebugEvents)dbgEvent.dwDebugEventCode, dbgEvent);
        dwContinueStatus = m_pEventHandler-&gt;ContinueStatus();

        bSuccess = BOOLIFY(ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, dwContinueStatus));
        if (!bSuccess)
        &#123;
            fprintf(stderr, &quot;ContinueDebugEvent returned failure. Error = %X\n&quot;, GetLastError());
            return false;
        &#125;
    &#125;
    return true;
&#125;</code></pre>
<p>其中<em>m_pEventHandler</em>负责注册处理程序并设置要继续传递给ContinueDebugEvent的继续状态。该示例代码为事件/异常注册处理程序，并输出与每个事件/异常相关的信息。所有事件和异常均遵循以下样式：</p>
<blockquote>
<p>笔者注：</p>
<p>“ / ” 表示或的意思</p>
<p>m_pEventHandler是DebugEventHandler类的实例， m_pEventHandler-&gt;Notify是一个分发函数，当传入的不同DebugEvents值时，能够调用不同的处理函数，具体实现在DebugEventHandler.cpp中</p>
<p>实例化代码在Source.cpp的Debbugger构造函数中</p>
<p>m_pEventHandler = std::unique_ptr<DebugEventHandler>(new DebugEventHandler);</p>
</blockquote>
<pre><code class="C++">Register(DebugEvents::eCreateThread, [&amp;](const DEBUG_EVENT &amp;dbgEvent)
&#123;
    auto &amp;info = dbgEvent.u.CreateThread;
    fprintf(stderr, &quot;CREATE_THREAD_DEBUG_EVENT received.\n&quot;
        &quot;Handle: %X\n&quot;
        &quot;TLS base: %X\n&quot;
        &quot;Start address: %X\n&quot;,
        info.hThread, info.lpThreadLocalBase, info.lpStartAddress);
    SetContinueStatus(DBG_CONTINUE);
&#125;);

Register(DebugEvents::eCreateProcess, [&amp;](const DEBUG_EVENT &amp;dbgEvent)
&#123;
    auto &amp;info = dbgEvent.u.CreateProcessInfo;
    fprintf(stderr, &quot;CREATE_PROCESS_DEBUG_EVENT received.\n&quot;
        &quot;Handle (image file): %X\n&quot;
        &quot;Handle (process): %X\n&quot;
        &quot;Handle (main thread): %X\n&quot;
        &quot;Image base address: %X\n&quot;
        &quot;Debug info file offset: %X\n&quot;
        &quot;Debug info size: %X\n&quot;
        &quot;TLS base: %X\n&quot;
        &quot;Start address: %X\n&quot;,
        info.hFile, info.hProcess, info.hThread, info.lpBaseOfImage,
        info.dwDebugInfoFileOffset, info.nDebugInfoSize, info.lpThreadLocalBase,
        info.lpStartAddress);

    m_hProcess = info.hProcess;

    SetContinueStatus(DBG_CONTINUE);
&#125;);</code></pre>
<p>以上就是一个最最基础的调试器的基本内容了。该调试器具有附加/分离，处理调试事件以及与这些事件有关的输出信息的功能。为了对此进行测试，我们可以创建一个简单的程序来生成一个异常，该异常将在附加到调试器时捕获。</p>
<blockquote>
<p>原文的案例不太好操作，我做了点优化</p>
</blockquote>
<pre><code class="C++">#include &lt;stdio.h&gt;
#include &lt;Windows.h&gt;

int main(int argc, char *argv[])
&#123;
    printf(&quot;Please debug me. \n&quot;);

    while (!IsDebuggerPresent())
    &#123;
        Sleep(0.1);
    &#125;

    OutputDebugStringA(&quot;This should be seen by the debugger.\n&quot;);
    RaiseException(STATUS_ACCESS_VIOLATION, 0, 0, NULL);

    return 0;
&#125;</code></pre>
<p>以下是调试器附加到进程并接收<strong>访问异常</strong>时的输出</p>
<pre><code class="json">Debug event raised in process 136C -- thread 624.
CREATE_PROCESS_DEBUG_EVENT received.
Handle (image file): 3C
Handle (process): 38
Handle (main thread): 34
Image base address: 12B0000
Debug info file offset: 0
Debug info size: 0
TLS base: 7EFDD000
Start address: 0
Debug event raised in process 136C -- thread 624.
LOAD_DLL_DEBUG_EVENT received.
Handle: 40
Base address: 76F10000
Debug info file offset: 0
Debug info size: 0
Name: \\?\C:\Windows\SysWOW64\ntdll.dll
Debug event raised in process 136C -- thread 624.
LOAD_DLL_DEBUG_EVENT received.
Handle: 44
Base address: 74C70000
Debug info file offset: 0
Debug info size: 0
Name: \\?\C:\Windows\SysWOW64\kernel32.dll
Debug event raised in process 136C -- thread 624.
LOAD_DLL_DEBUG_EVENT received.
Handle: 48
Base address: 74C10000
Debug info file offset: 0
Debug info size: 0
Name: \\?\C:\Windows\SysWOW64\KernelBase.dll
Debug event raised in process 136C -- thread 624.
LOAD_DLL_DEBUG_EVENT received.
Handle: 4C
Base address: 73720000
Debug info file offset: 0
Debug info size: 0
Name: \\?\C:\Windows\SysWOW64\msvcr120.dll
Debug event raised in process 136C -- thread 101C.
CREATE_THREAD_DEBUG_EVENT received.
Handle: 50
TLS base: 7EFDA000
Start address: 76FAF7EA
Debug event raised in process 136C -- thread 101C.
Received exception event.
First chance exception: 1
Exception code: 80000003
Exception flags: 0
Exception address: 76F2000C
Number parameters (associated with exception): 1
Received breakpoint
Debug event raised in process 136C -- thread 101C.
EXIT_THREAD_DEBUG_EVENT received.
Thread 101C exited with code 0.
/*---------------------------------------------------------------------------*/
Debug event raised in process 136C -- thread 624.
OUTPUT_DEBUG_STRING_EVENT received.
Debug string: This should be seen by the debugger.
/*---------------------------------------------------------------------------*/
Debug event raised in process 136C -- thread 624.
Received exception event.
First chance exception: 1
Exception code: C0000005
Exception flags: 0
Exception address: 74C1B727
Number parameters (associated with exception): 0
Received access violation
/*---------------------------------------------------------------------------*/
Debug event raised in process 136C -- thread 624.
Received exception event.
First chance exception: 0
Exception code: C0000005
Exception flags: 0
Exception address: 74C1B727
Number parameters (associated with exception): 0
Received access violation</code></pre>
<p>从输出中可以看到，调试器在附加时会收到<code>CREATE_PROCESS_DEBUG_EVENT</code>。此事件始终是调试器附加时触发的第一个事件，它使调试器获得进程的句柄，该句柄使调试器可以从进程内存中进行读取/写入，更改进程线程上下文等。它还可以提供有关数据类型的信息，调试与流程相关的信息。接下来是与进程地址空间中任何已加载DLL相关的事件。之后出现了两个有趣的事件。它们是<code>CREATE_THREAD_DEBUG_EVENT</code>，是一个异常，其异常代码对应于<code>EXCEPTION_BREAKPOINT</code>。这些将在之后的部分中介绍。最后，调试器成功显示该进程提供的调试字符串，并显示访问冲突也被成功接收。由于调试器示例代码不会处理该异常，因此可以看到多次引发了异常。最初，它是作为<code>First chance exception</code>，但由于目标进程无法处理它，因此又作为第二次/最后一次机会异常出现了。然后，该过程以与<code>EXCEPTION_ACCESS_VIOLATION</code>相对应的状态码终止。</p>
<p><strong>附加调试器后实际上会发生什么？</strong></p>
<p>关于调试器输出的当前一个谜可能是那些<em>CREATE_THREAD_DEBUG_EVENT</em>和<em>EXIT_THREAD_DEBUG_EVENT</em>事件来自何处。这些事件是作为调试器附加到进程的结果而触发的。调用<code>DebugActiveProcess</code>时，它将转发到<code>NtDebugActiveProcess</code> <code>syscall</code>。该系统调用负责将流程设置为可调试状态，这涉及更改<a target="_blank" rel="noopener" href="https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb">Process Environment Block</a>的<strong>BeingDebugged</strong>标志用于目标进程的方法<strong>IsDebuggerPresent</strong>函数在目标进程中的工作方式，以检查它是否正在调试。之后，将在目标进程中创建一个线程。该线程将具有一个对应于0xCC（int 3）指令的起始地址，这就是我们常说的断点。这就是调试器显示为已收到断点的原因。当继续执行时，该线程退出，进程再次开始正常执行。</p>
<p>原文链接：<a target="_blank" rel="noopener" href="http://www.codereversing.com/blog/archives/168">http://www.codereversing.com/blog/archives/168</a></p>

            <hr>
          </div>
          <br>
          <div>
            <p>
            
            
              <span>
                <i class="iconfont icon-tag"></i>
                
                  <a class="hover-with-bg" href="/tags/%E9%80%86%E5%90%91/">逆向</a>
                
              </span>
            
            </p>
            
              <p class="note note-warning">本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://zh.wikipedia.org/wiki/Wikipedia:CC_BY-SA_3.0%E5%8D%8F%E8%AE%AE%E6%96%87%E6%9C%AC" rel="nofollow noopener noopener">CC BY-SA 3.0协议</a> 。转载请注明出处！</p>
            
          </div>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container">
        <div id="toc">
  <p class="h5"><i class="far fa-list-alt"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>
      </div>
    
  </div>
</div>

<!-- custom -->


<!-- Comments -->
<div class="col-lg-7 mx-auto nopadding-md">
  <div class="container comments mx-auto" id="comments">
    
      <br><br>
      
      
  <div class="disqus" style="width:100%">
    <div id="disqus_thread"></div>
    <script>
      var disqus_config = function () {
        this.page.url = 'http://cve.gitee.io/cve/2020/11/20/编写基础调试器：第一部分（基础）/';
        this.page.identifier = '/2020/11/20/编写基础调试器：第一部分（基础）/';
      };
      var oldLoad = window.onload;
      window.onload = function () {
        var d = document, s = d.createElement('script');
        s.type = 'text/javascript';
        s.src = '//' + 'crayon-1' + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
      };
    </script>
    <noscript>Please enable JavaScript to view the <a target="_blank" href="https://disqus.com/?ref_noscript" rel="nofollow noopener noopener">comments
        powered by Disqus.</a></noscript>
  </div>


    
  </div>
</div>

    
  </main>

  
    <a class="z-depth-1" id="scroll-top-button" href="#" role="button">
      <i class="fa fa-chevron-up scroll-top-arrow" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  <footer class="mt-5">
  <div class="text-center py-3">
    <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><b>Hexo</b></a>
    <i class="iconfont icon-love"></i>
    <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"> <b>Fluid</b></a>
    <br>

    
  
    <!-- 不蒜子统计PV -->
    
    &nbsp;<span id="busuanzi_container_site_pv"></span>总访问量 
          <span id="busuanzi_value_site_pv"></span> 次&nbsp;
  
  
    <!-- 不蒜子统计UV -->
    
    &nbsp;<span id="busuanzi_container_site_uv"></span>总访客数 
            <span id="busuanzi_value_site_uv"></span> 人&nbsp;
  
  <br>



    


    <!-- cnzz Analytics icon -->
    

  </div>
</footer>

<!-- SCRIPTS -->
<script src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script src="https://cdn.staticfile.org/popper.js/1.16.1/umd/popper.min.js" ></script>
<script src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script src="https://cdn.staticfile.org/mdbootstrap/4.13.0/js/mdb.min.js" ></script>
<script src="/js/main.js" ></script>


  <script src="/js/lazyload.js" ></script>



  
  <script src="https://cdn.staticfile.org/tocbot/4.10.0/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var navHeight = $('#navbar').height();
      var toc = $('#toc');
      var main = $('main');
      var tocT = navHeight + (toc.offset().top - main.offset().top);
      var tocLimMin = main.offset().top - navHeight;
      var tocLimMax = $('#comments').offset().top - navHeight;
      $(window).scroll(function () {
        var scroH = document.body.scrollTop + document.documentElement.scrollTop;
        if (tocLimMin <= scroH && scroH <= tocLimMax) {
          toc.css({
            'display': 'block',
            'position': 'fixed',
            'top': tocT,
          });
        } else if (scroH <= tocLimMin) {
          toc.css({
            'position': '',
            'top': '',
          });
        } else if (scroH > tocLimMax) {
          toc.css('display', 'none');
        }
      });
      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '.post-content',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        scrollSmooth: true,
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc > p').css('visibility', 'visible');
      }
    });
  </script>







  <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>


<!-- Plugins -->



  <script src="https://cdn.staticfile.org/prettify/188.0.0/prettify.min.js" ></script>
  <script>
    $(document).ready(function () {
      $('pre').addClass('prettyprint  linenums');
      prettyPrint();
    })
  </script>





  <script src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      getSearchFile(path);
      this.onclick = null
    }
  </script>



  <script src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <script>
    $("#post img:not(.no-zoom img, img[no-zoom])").each(
      function () {
        var element = document.createElement("a");
        $(element).attr("data-fancybox", "images");
        $(element).attr("href", $(this).attr("src"));
        $(this).wrap(element);
      }
    );
  </script>












</body>
</html>
